Loading SUBLAKELoading SUBLAKELast updated: April 30, 2026
SUBLAKE is committed to full compliance with the General Data Protection Regulation (GDPR) and protecting the rights of individuals in the European Economic Area (EEA), United Kingdom, and Switzerland. This page outlines our GDPR compliance framework, your rights as a data subject, and how we protect your personal data.
As both a data controller (for data we collect directly) and a data processor (for data our customers store on our platform), we are committed to:
We process personal data under the following legal bases as defined in Article 6 of the GDPR:
| Processing Activity | Legal Basis |
|---|---|
| Providing the Service | Contract performance (Art. 6(1)(b)) |
| Payment processing | Contract performance (Art. 6(1)(b)) |
| AI-powered automation | Contract performance (Art. 6(1)(b)) |
| Security monitoring | Legitimate interest (Art. 6(1)(f)) |
| Analytics and improvement | Legitimate interest (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)) |
| Tax and legal compliance | Legal obligation (Art. 6(1)(c)) |
As a data subject, you have the following rights under the GDPR:
Right of Access (Art. 15)
Obtain confirmation of whether we process your data and request a copy of it.
Right to Rectification (Art. 16)
Request correction of inaccurate personal data without undue delay.
Right to Erasure (Art. 17)
Request deletion of your personal data when it is no longer necessary for its original purpose.
Right to Restriction (Art. 18)
Request limitation of processing in certain circumstances (e.g., while verifying accuracy).
Right to Portability (Art. 20)
Receive your personal data in a structured, machine-readable format and transfer it to another controller.
Right to Object (Art. 21)
Object to processing based on legitimate interests, including profiling and direct marketing.
Right re: Automated Decisions (Art. 22)
Not be subject to decisions based solely on automated processing that significantly affect you.
We will respond to rights requests within 30 days. In complex cases or where there are many requests, this may be extended by an additional 60 days with prior notification.
SUBLAKE acts in two capacities depending on the context:
When we act as a data processor, you remain the data controller and are responsible for ensuring you have a lawful basis for processing the personal data of your own customers.
We offer a comprehensive Data Processing Agreement (DPA) to all customers as required by Article 28 of the GDPR. Our DPA includes:
Read our DPA
SUBLAKE's standard Data Processing Agreement is published in full and applies automatically to every customer with EU/UK/Swiss data subjects.
View the Data Processing Agreement →Need a counter-signed PDF for your records? Email contact@sublake.com.
We use the following sub-processors to provide our services. All are bound by data processing agreements that meet GDPR requirements:
| Sub-Processor | Purpose | Location |
|---|---|---|
| Supabase | Database hosting and authentication | USA (AWS us-east-1) |
| Anthropic | AI processing (no data retention) | USA |
| Vercel | Frontend hosting | USA (Global CDN) |
| Railway | Backend hosting | USA |
| Stripe | Payment processing | USA/Ireland |
| Resend | Transactional email delivery | USA |
| Sentry | Error monitoring | USA |
We will notify customers of any new sub-processors at least 30 days before they begin processing data. Customers may object to a new sub-processor as outlined in our DPA.
As our infrastructure is primarily located in the United States, personal data from EEA/UK residents may be transferred internationally. We ensure adequate protection through:
We implement comprehensive security measures as required by Article 32 of the GDPR:
In the event of a personal data breach, we will:
For all GDPR-related inquiries, data subject requests, or to report a data protection concern, please contact our Data Protection Officer:
Data Protection Officer
SUBLAKE Holdings LLC
Email: contact@sublake.com
Subject line: "GDPR Request"
To exercise any of your rights under the GDPR:
There is no fee for exercising your rights. However, we may charge a reasonable fee for manifestly unfounded or excessive requests, or refuse to act on such requests.